🇺🇸
jmr777
2026-10-12 18:02:00
UTC ·
(1 month ago)
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env||RSV:8.75||T:APACHE||
Sensor:
modsec
Rule:
77045402
Abuser:
34.24.88.244
Web App Attack
🇺🇸
chronos
2026-10-12 06:51:23
UTC ·
(1 month ago)
[AUTORAVALT][[12/10/2026 - 03:51:23 -03:00 UTC]
Attack from [Google LLC]
[34.24.88.244][244.88.24.34.bc.googleusercontent.com]
Action: BLocKed
Hacking... Unauthorized attempts to access the server.
Web App Attack -> Attempts to probe for or exploit ...
show more
[AUTORAVALT][[12/10/2026 - 03:51:23 -03:00 UTC]
Attack from [Google LLC]
[34.24.88.244][244.88.24.34.bc.googleusercontent.com]
Action: BLocKed
Hacking... Unauthorized attempts to access the server.
Web App Attack -> Attempts to probe for or exploit installed web applications such as a CMS like WordPress/Drupal, e-commerce solutions, forum software, phpMyAdmin]
...
show less
Hacking
Web App Attack
🇺🇸
chronos
2026-10-12 06:17:37
UTC ·
(1 month ago)
[AUTORAVALT][[12/10/2026 - 03:17:36 -03:00 UTC]
Attack from [Google LLC]
[34.24.88.244][244.88.24.34.bc.googleusercontent.com]
Action: BLocKed
Bad Web Bot -> Webpage scraping (email extraction, content, etc.) crawlers that do not respect robots.txt ...
show more
[AUTORAVALT][[12/10/2026 - 03:17:36 -03:00 UTC]
Attack from [Google LLC]
[34.24.88.244][244.88.24.34.bc.googleusercontent.com]
Action: BLocKed
Bad Web Bot -> Webpage scraping (email extraction, content, etc.) crawlers that do not respect robots.txt. Excessive requests and user agent spoofing.
]
...
show less
Bad Web Bot
2026-10-11 07:02:20
UTC ·
(1 month ago)
Web App Attack
🇩🇪
hbrks
2026-10-11 04:48:40
UTC ·
(1 month ago)
200 attack(s) detected, such as these: {"event":"web_block","ip":"34.24.88.244","host":"api.marche-be.com","request":"GET /app HTTP/2.0","user_agent":"","reason":"Status-404","timestamp":"2026-10-11T04:48:40 00:00","logentry":"api.marche-be.com 34.24 ...
show more
200 attack(s) detected, such as these: {"event":"web_block","ip":"34.24.88.244","host":"api.marche-be.com","request":"GET /app HTTP/2.0","user_agent":"","reason":"Status-404","timestamp":"2026-10-11T04:48:40 00:00","logentry":"api.marche-be.com 34.24.88.244 - - [11/Oct/2026:04:48:40 0000] \"GET /app HTTP/2.0\" 404 0 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36\" \"172.25.79.30:5000\""} * Report Details *: https://p4u.xyz/Q8E9XJVDH3D/1* IP Details *: https://p4u.xyz/Q8E9XJVDH3D/2
show less
Web Spam
Hacking
Bad Web Bot
🇩🇪
ghostwarriors
2026-10-11 03:50:26
UTC ·
(1 month ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
antlac1
2026-10-11 03:16:22
UTC ·
(1 month ago)
crowdsecurity/http-path-traversal-probing
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 03:15:13
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.24.88.244 (244.88.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 23:15:07.920028 2026] [security2:error] [pid 8933:tid 893 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.24.88.244 (244.88.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 23:15:07.920028 2026] [security2:error] [pid 8933:tid 8933] [client 34.24.88.244:39762] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||weyoungrenovations.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "weyoungrenovations.com"] [uri "/z9x8c7v6b5-debug-trigger-weyoungrenovations.com"] [unique_id "asr_O99WNrIuscfqzfudkQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
tvipper.com
2026-10-11 03:02:57
UTC ·
(1 month ago)
probing for exposed files and admin pages: 10 attempts within 1 minutes, seen by WAF and CrowdSec (reported by RemotePower)
Web App Attack
🇲🇾
Rizzy
2026-10-11 02:59:03
UTC ·
(1 month ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 02:56:17
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.24.88.244 (244.88.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 22:56:13.326055 2026] [security2:error] [pid 31215:tid 31 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.24.88.244 (244.88.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 22:56:13.326055 2026] [security2:error] [pid 31215:tid 31215] [client 34.24.88.244:46238] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||thebronsons.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "thebronsons.com"] [uri "/z9x8c7v6b5-debug-trigger-thebronsons.com"] [unique_id "asr6zWyr4YFEOrTVQO3YFwAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-11 02:50:55
UTC ·
(1 month ago)
34.24.88.244 - - [10/Oct/2026:21:50:53 -0500] "GET /.env HTTP/1.1" 301 243 "-" "Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" 172.71.22.67
34.24.88.244 - - [10/Oct/2026:21:50:54 ...
show more
34.24.88.244 - - [10/Oct/2026:21:50:53 -0500] "GET /.env HTTP/1.1" 301 243 "-" "Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" 172.71.22.67
34.24.88.244 - - [10/Oct/2026:21:50:54 -0500] "GET /.env HTTP/1.1" 403 199 "http://synapseresults.com/.env" "Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" 172.69.71.133
34.24.88.244 - - [10/Oct/2026:21:50:54 -0500] "GET /.env.example HTTP/1.1" 301 251 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)" 108.162.238.140
34.24.88.244 - - [10/Oct/2026:21:50:54 -0500] "GET /.env.production HTTP/1.1" 301 254 "-" "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)" 108.162.238.139
34.24.88.244 - - [10/Oct/2026:21:50:54 -0500] "GET /.env.local HTTP/1.1" 301 249 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)" 172.68.71.128
34.24.88.244 - - [10/Oct/2026:21:50:54 -0500] "G
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
CDO
2026-10-11 02:47:04
UTC ·
(1 month ago)
URL Injection attempt detected. Automated web attack.
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 02:34:53
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.24.88.244 (244.88.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 22:34:46.630968 2026] [security2:error] [pid 23912:tid 23 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.24.88.244 (244.88.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 22:34:46.630968 2026] [security2:error] [pid 23912:tid 23912] [client 34.24.88.244:58850] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||salsberggroup.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "salsberggroup.com"] [uri "/z9x8c7v6b5-debug-trigger-salsberggroup.com"] [unique_id "asr1xl06XXNTXgP4s9UmJAAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 02:15:33
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.24.88.244 (244.88.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 22:15:27.581117 2026] [security2:error] [pid 4193:tid 422 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.24.88.244 (244.88.24.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 22:15:27.581117 2026] [security2:error] [pid 4193:tid 4229] [client 34.24.88.244:58596] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "oplconnect.com"] [uri "/build/.env"] [unique_id "asrxP-MEi3un0B71wlI-bAAAAEo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
